masslogger | cfe33b2a83ab6125597d848a0fcfe2262e3d62dd070d81d7f283051cdb30548e

Analysis

max time kernel
43s
max time network
102s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW ORDER 4567.exe
Size 1.9MB
Sample201109-cyx4e6a7ce
SHA256 cfe33b2a83ab6125597d848a0fcfe2262e3d62dd070d81d7f283051cdb30548e
MD5 d9362bbc5d15120a6d60caac279cadc6
SHA1 fa774ad0a31ecc961c2ae2afbfc3b1b4a7b20b58
SHA512 b1eb04bbcd2ab306c107e962d20b6391c5ab3d8db6fe339fbaf578bcef5a08c88fde5d130ae0d4b3643943f97e86bbca7cdb96c17e31cb4744770e343e9e7d6c
MD5 SHA1 SHA512

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2084-0-0x0000000000700000-0x00000000007A8000-memory.dmp	family_masslogger
behavioral2/memory/2084-1-0x00000000007A2BDE-mapping.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4760 set thread context of 2084	4760	NEW ORDER 4567.exe	78

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1128	powershell.exe
1128	powershell.exe
1128	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1128	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4760	NEW ORDER 4567.exe
4760	NEW ORDER 4567.exe
4760	NEW ORDER 4567.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4760	NEW ORDER 4567.exe
4760	NEW ORDER 4567.exe
4760	NEW ORDER 4567.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2084	4760	NEW ORDER 4567.exe	78
PID 4760 wrote to memory of 2084	4760	NEW ORDER 4567.exe	78
PID 4760 wrote to memory of 2084	4760	NEW ORDER 4567.exe	78
PID 4760 wrote to memory of 2084	4760	NEW ORDER 4567.exe	78
PID 4760 wrote to memory of 2084	4760	NEW ORDER 4567.exe	78
PID 2084 wrote to memory of 640	2084	MSBuild.exe	80
PID 2084 wrote to memory of 640	2084	MSBuild.exe	80
PID 2084 wrote to memory of 640	2084	MSBuild.exe	80
PID 640 wrote to memory of 1128	640	cmd.exe	82
PID 640 wrote to memory of 1128	640	cmd.exe	82
PID 640 wrote to memory of 1128	640	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\NEW ORDER 4567.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER 4567.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-20-0x0000000008020000-0x0000000008021000-memory.dmp

Download

memory/1128-14-0x0000000007080000-0x0000000007081000-memory.dmp

Download

memory/1128-26-0x00000000073C0000-0x00000000073C1000-memory.dmp

Download

memory/1128-25-0x0000000009990000-0x0000000009991000-memory.dmp

Download

memory/1128-24-0x0000000009520000-0x0000000009521000-memory.dmp

Download

memory/1128-23-0x0000000009F70000-0x0000000009F71000-memory.dmp

Download

memory/1128-13-0x0000000073150000-0x000000007383E000-memory.dmp

Download

memory/1128-22-0x0000000008880000-0x0000000008881000-memory.dmp

Download

memory/1128-21-0x0000000008540000-0x0000000008541000-memory.dmp

Download

memory/1128-17-0x0000000008050000-0x0000000008051000-memory.dmp

Download

memory/1128-19-0x0000000008130000-0x0000000008131000-memory.dmp

Download

memory/1128-15-0x0000000007770000-0x0000000007771000-memory.dmp

Download

memory/1128-16-0x0000000007DD0000-0x0000000007DD1000-memory.dmp

Download

memory/2084-8-0x0000000005060000-0x0000000005061000-memory.dmp

Download

memory/2084-2-0x0000000072B90000-0x000000007327E000-memory.dmp

Download

memory/2084-0-0x0000000000700000-0x00000000007A8000-memory.dmp

Download

memory/2084-9-0x00000000050D0000-0x00000000050D1000-memory.dmp

Download

memory/2084-7-0x0000000002830000-0x000000000286E000-memory.dmp

Download

memory/2084-6-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Download

memory/2084-5-0x0000000005260000-0x0000000005261000-memory.dmp

Download

memory/2084-3-0x0000000000700000-0x0000000000701000-memory.dmp

Download